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-- Abstract — 


The service longevity of complex propulsion systems — such as the SSMF — can he at risk from 
several competing failure modes. Conventional life assessment practice focuses upon the most 
severely life-limited feature of a given component, even though there may he other, less severe, 
potential failure locations. Primary, secondary, tertiary failure modes, as well as their associated 
probabilities, must also be considered. Furthermore, these probabilities arc functions of 
accumulated service time. Thus a component may not always succumb to the most severe, or 
even the most probable failure mode. 

Propulsion system longevity must be assessed by considering simultaneously the actions of, and 
interactions among, life-limiting influences. These include, but arc not limited to, high 
frequency fatigue (HFF), low cycle fatigue (LCF) and subsequent crack propagation, thermal 
and acoustic loadings, and the influence of less-than-ideal nondestructive evaluation (NDH). 
This paper provides an outline for a probabilistic model for service life analysis, and reports on 
progress towards its implementation. The work is being performed by Pratt & Whitney under 
NAS8-36901. 


Introduction and Background 

Present fracture mechanics analyses for SSMF critical structural components may 
underestimate life by assuming the worst-case conditions to define single values of 
life-controlling parameters even though these parameters are subject to statistical variations. 
The probability of occurrence for any individual worst-case condition is very low, while that of 
a combination of worst-case conditions is infinitesimal. These life underestimates can result in 
inefficient use of material and/or excessive component weight causing a reduced payload 
capacity and an increased operations cost. SSMF life analyses may also overestimate life by the 
assumption of greater material/structural capabilities and/or less severe operating conditions. 

Advancing technology is imposing increasing demands on structural analysis methods. The 
previously acceptable technique of assuming worst-case conditions is no longer a viable method 
for analyzing SSMF operating systems. A more accurate life assessment technique is needed 
which will account for errors in life estimates and also provide a tool for statistically assessing 
the level of risk created by engineering decisions involved in defining a system design. 

The objective of this program is to develop a computer code for performing fracture mechanics 
calculations which consider distributions of major SSMF. life-controlling parameters, rather 
than the traditional single-valued, worst-case, estimates. 
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Probabilistic Modeling 

The Space Shuttle Probabilistic Optimization ("ode, SSPOC, has as its objective estimating the 
uncertainty in SSMT component cyclic longevity which necessarily results from the engineering 
uncertainties in life-controlling parameters. Only by understanding the probabilistic behavior 
of these components can realistic mission risk assessments be undertaken. 

Among the necessary uncertainties which must be addressed by a probabilistic simulation are 
uncertainties in: 

1. Initial material quality (IMQ) 

2. Stress analysis variability 

3. Crack initiation life (Tow Cycle f atigue) 

4. Nondestructive evaluation (NOT) 

5. (Tack size vs. propagation life (a vs. N) 

6. (Tack initiation life (High Cycle fatigue) 

7. Mission severity 

The following discussion illustrates how statistical uncertainties can be modeled algorithmically 
for four major elements: (1) TCP variability; (2) stress variability; (3) NDH variability; and 
(4) fracture mechanics crack propagation (a vs. N) variability. flic examples are greatly 
simplified for expository purposes, while the actual SSPOC computer code is necessarily more 
complex. The underlying ideas are , however, very similar. 


Modeling LCF Probabilistically 

first consider that fatigue, even under well-controlled laboratory conditions, is a stochastic 
process. That is: even when stress, temperature, loading frequency and stress ratio, are known 
"exactly", the resulting fatigue life displays considerable variability. In an actual component 
these, and other, life-controlling parameters arc not known exactly. Rather, parameters must 
be described as statistical distributions of possible values, some values being more likely than 
others. It is conventional statistical practice to describe these effects using some engineering 
model for the expected, or mean, behavior plus an error term to account for uncertainty in 
outcome. As an example, the expected fatigue life, A> at a given stress, v, might be modeled 
using a simple inverse relationship between stress and the logarithm of life: 


logN f =a+b(lls) [1] 

where a and h arc s-N model parameters. 

The uncertainty is then treated as a normal distribution of logarithmic errors, with zero mean, 
and some specified variance, a 2 . (The zero mean implies that the model is expected to be 
correct, on the average.) 

The resulting log life would then be: 


logty=a + A(1 /.v) + k, [2] 

where s, is the normally distributed uncertainty. The following segments of pseudocode 
illustrate the implementation of these ideas. 

For a given stress (and temperature, ...) fatigue life can be modeled algorithmically as follows: 
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Pseudocode 


PROCEDURE "LI EEC A EC" 

EOR STRESS = s, 

BEGIN: 

CALCULATE: expected behavior 
log N f = a + h{\lx f ) 

CALCULATE: life model random error 

CALCIJEATE: individual lire 
log N,= N f + s, 

N,= 

STORE the ith life, N„ for further consideration 

END: 


Now consider the introduction of an additional systematic uncertainty. Stress is not known 
exactly, so it too has an associated — and of course different -- error structure. (Some 
individuals are uncomfortable with the word "error", and prefer to use "uncertainty". In this 
discussion we will use both terms interchangeably). 

The uncertainty in exactly knowing stress influences the overall uncertainty in component life. 
The following segment of pseudocode illustrates how this effect can be modeled mathematically. 


Pseudocode 

PROCEDURE "STRESSCALC" 

FOR DESIGN STRESS = .v, 

BEGIN: 

CAECUEATE: expected stress 

s = s d 

CAECUEATE: stress random error 

e,= (V(0,*?) 

CALCULATE: individual stress 

5 , = S + 8 , 

END: 


These two examples have been greatly simplified for purposes of explanation, but they illustrate 
how the SSPOC code treats both deterministic and random influences in overall component life 
uncertainty. The next segment of pseudocode shows how these two effects (life uncertainty at 
a known stress and uncertainty in knowing the stress) can be combined. 


Psuedocode 

PROCEDURE "FATIGUE FIFE" 

BEGIN: 

CALCULATE: individual stress 

CALL PROCEDURE "STRESSCALC" 
(we now have an individual value of .v,) 
CALCULATE: life at s, 

CALL PROCEDURE "LI EEC A EC" 
(returns an individual value of N,) 

END: 
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So far we've calculated a single fatigue initiation life which has been influenced by both stress 
and life model uncertainties. After accumulating these initiation cycles and exhausting its 
initiation life, the part will now contain a crack of a given si/c. 


Modeling the Inspection Process 

After having initiated a crack, a part docs not necessarily immediately fail. Depending on its 
design it may survive several subsequent missions. ( This is especially true of components 
designed using damage-tolerance concepts). Furthermore, if a component can be inspected 
between rcturn-to-service intervals, damaged parts can be removed and replaced, and the overall 
system reliability thereby greatly improved. Inspection too is a stochastic process, and the 
probability of crack detection (POD) is a function of cracksizc (a) (Thompson and Chimenti, 
editors, 1982-1986). 

Recent advances in the application of statistical modeling techniques to NonDestructive 
Evaluation (NDE) have allowed incorporation of both left- and right-censored observations in 
modeling the Probability of Detection vs cracksi/.c (POD vs. a) relationship (Annis and Erland, 
1987). The log-logistic function is one example of a POD — f(a) model. 

POD = [e* +P ln(a) ]/[ 1 + e a+P ln(a) ] [3] 

For a given cracksize, POD can be modeled as follows: 


Pseudocode 

PROCEDURE "NDECAEC" 

FOR CRACKSIZE = a, 

BEGIN: 

CALCULATE: POD, 

POD, —f(a) 

INSPEC I : inspect the part 

GENERATE: random P, uniformly distributed [0,1] 
COMPARE: individual probability of detection with P, 
IF P,< POD, THEN retire part 
ELSE return part to service 

END: 


To summarize to this point, the pseudocode illustrates modeling the behavior of an individual 
life-limiting location on a single component: its life to initiate a crack of a given size, and the 
result of subsequent inspection. The following discussion continues the theme of stochastic 
modeling from Low Cycle Fatigue (LCF) into the area of crack propagation. The examples are 
again greatly simplified for expository purposes. 


Fracture Mechanics Modeling 

(Tack propagation also, even under well-controlled laboratory conditions, is a stochastic 
process. Even when stress, temperature, loading frequency and stress ratio, are known 
"exactly", the resulting fracture mechanics (FM) life can display variability. As with LCF, in 
an actual component these life-controlling parameters arc not known exactly. Again, these 
parameters may be described as statistical distributions of possible values, some values being 
more likely than others. As a greatly simplified example, the expected stress intensity K at a 
given stress, s , might be modeled using a simple relationship between stress and the stress 
intensity: 
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[4] 


K=sJ(™) 

where a represents crack size. 

(Remember that the uncertainty in stress was treated as a normal distribution of errors, with 
zero mean and some specified variance, < t 2 in the preceding discussion.) 

Now consider the problem of relating stress intensity to fracture mechanics life. Perhaps the 
simplest relationship between stress intensity and fracture mechanics life is the Paris equation, 
a straight line in the log {dajdN) vs log(tf) plane; that is: 


log {dajdN) = b 0 + b { \o^K) [5] 

where dajdN is crack growth rate and b n , A, arc model parameters. 

Substituting equation [4] into equation [5] results in a simple linear fust order differential 
equation. Separating variables and integrating gives: 


*i=l >/ 


,(1— b t /2) (1-ft,/ 2) 


*1 


]/[>, 


ft, ft,/ 2,, 

o* '* (1 


h t l 2 )] 


[ 6 ] 


where a f = final crack size and a,= initial crack size. (As with 1(1 modeling, other, more 
complicated, models may be required in many cases.) 

This equation then directly relates stress and fracture mechanics life, l or a given component, 
design calculations can arrive at a nominal, or mean, predicted fracture mechanics life vs. 
cracksize curve. Then, given the design stress, parameters A n and A, can be determined. 

Even when stress is known "exactly", as it is in laboratory conditions, predicted crack 
propagation life exhibits some variability, which can be considered as uncertainty in the fracture 
mechanics life prediction calculation. An analysis and comparison of predicted and actual lives 
from specimen tests and laboratory component tests may be used to estimate the distribution 
of Actual/Predicted (observed life divided by calculated life) lives. This uncertainty in AOVRP 
can be modeled as a normal distribution of logarithmic errors with mean // and variance <r 2 . 

The following pseudocode shows how the individual fracture mechanics life may be determined. 
Remember that the individual stress, s, was previously found using "STRESSCALC". Note also 
that the FM life is directly dependent on applied stress. 


Pseudocode 

PROCEDURE "FM LIFE" 

FOR APPLIED STRESS = .v, 

BEGIN: 

CALCULATE: expected fracture mechanics life 
N,= [a}' *i a/' A ' ,2) ]/[^ ■V'orV^l _ A,/ 2)J 
CALCULATE: AOVRP random error due to life prediction uncertainty 
AOVRP, = N(y, a 2 ) 

CALCULATE: individual fracture mechanics life 
N,~ NJ AOVRP, 

END: 
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Tying It All Together 

So far we've calculated a single fatigue initiation life which has been influenced by both stress 
and life model uncertainties, the probabilistic outcome of the inspection process, and, assuming 
the part was returned to service, the fracture mechanics life dependent on cracksize and stress. 
To examine the behavior of an entire population of components, the procedure {initiate a crack, 
inspect, return to service) must be repeated many times, but using different individual errors 
each time. For example: 


Pseudocode 

PROCEDURE "POPULATION" 

BEGIN: 

FOR N = 1 to 10,000 

CALL PROCEDURE "FATIGUE LIFE" 
CALL PROCEDURE "NDECALC" 
CALL PROCEDURE "EM LIFE" 

END: 


Each call to "FATIGUE LIFE" returns an individual initiation life, and stores it for further 
statistical analysis; the calls to "NDECALC'" and "FMLIFE" perform a similar function for 
inspection results and fracture mechanics life. Therefore procedure "POPULATION" has 
stored 10,000 (or whatever number is appropriate) individual component initiation and fracture 
lifetimes along with the corresponding inspection outcomes, each having been influenced by the 
various modeling uncertainties. 

Of course there are many other parameters which can affect a component's cyclic longevity. 
The purpose of the forgoing discussion was to illustrate, in admittedly simplistic terms, how 
these many interacting life-controlling parameters can be modeled by first considering the 
individual contributions to overall uncertainty, and then combining these elemental results in a 
statistically correct form. 

Again, it is very important not to lose sight of the goal: to model component lifetime 

uncertainty. Without special caution it is easy to become so involved in the potential intricacies 
of modeling an individual effect that the overall goal is compromised. 

This paper discusses only the rudimentary aspects of probabilistic life modeling. Any real 
component may have several life-limiting locations, some of which may interact either 
simultaneously or sequentially. Intrinsic material quality (microstructural anomalies, poor 
weldments, etc.) can also influence system longevity. Although beyond the scope of this paper, 
SSPOC addresses these and other complex life-controlling effects, and can provide valid 
estimates of space shuttle hardware reliability. 

Pratt & Whitney has nearly a decade of experience in probabilistic life assessment for gas 
turbine engines. As a result of the Retirement for Cause program, life cycle cost savings of $966 
million are projected for the USAF F100-PW- 100/200 engine systems over the period 1986 to 
2005 (Harris, et. al, 1987). Maintenance intervals and risk analyses for the RFC program were 
based on simulations using the Probabilistic Life Analysis Technique (Watkins & Annis, 1985). 

This program will build on P & W experience to develop a stand-alone probabilistic life analysis 
computer code, refined and tailored for SSME applications. A complete user's manual 
including tutorial training sessions at NASA-MSI C will be provided. Two SSME life analysis 
test cases using SSPOC will be completed. The software will then be installed at NASA-MSFC; 
software installation will be verified by reproducing the SSME life analysis test cases results at 
NASA-MSFC. 
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